[Editor's Notes: Viagra is often sold in conjunction with MDMA in order to help users compensate for the reduced sexual performance that is a common side-effect resulting from abuse of MDMA. This appears to be the first ever report of a counterfeit Viagra tablet to Microgram Bulletin.]

The Illinois State Police Forensic Science Center at Chicago (Chicago, Illinois) recently received two submissions containing a total of 55 lollipops, suspected to contain a controlled substance, possibly MDMA, THC, or GHB. The lollipops were being sold on the West Side of Chicago, and were seized by the Chicago Police Department. Analysis was prioritized because the items were apparently being marketed to children. Each lollipop weighed approximately 10 grams, and were either green, red, or amber colored, and were in the shape of a maple leaf (see Photo 8)

Photo 8	Photo 9

or an indistinct face resembling Santa Claus (see Photo 9, above). No visible plant material was observed; however, a crushed portion tested positive for tetrahydrocannabinol (THC) with the Duquenois Levine test. Analysis by GC and GC/MS indicated a mixture of THC and phencyclidine (PCP) (quantitation not performed). This was the laboratory's first submission of this type.

Photo 10

The DEA Northeast Laboratory (New York, New York) recently received a submission of nine large capacitors, each containing a tan powder, suspected heroin (see Photo 10). The capacitors were originally attached to a circuit board (nominal purpose unknown), that had been shipped as air freight from Venezuela to Philadelphia, Pennsylvania, that was seized by Immigration and Customs Enforcement Inspectors from the Philadelphia Office. Analysis of the powder (total net mass 493.7 grams) by GC/FID, GC/MS, and FTIR confirmed 80 percent heroin hydrochloride. This was the first submission of this type to the laboratory; however, two additional circuit boards with capacitors containing heroin have been received since this initial encounter.

- INTELLIGENCE ALERT -

ONCE REMOVED® NAIL POLISH REMOVER (CONTAINING GBL)
SEIZED IN METAIRIE, LOUISIANA

Photo 11

The DEA South Central Laboratory (Dallas, Texas) recently received a submission of two bottles of "Once Removed" nail polish remover and treatment, each containing 30 milliliters of a clear, oily liquid, submitted as unknowns (see Photo 11). Although the packaging appears to be professional, the labelling does not list the ingredients, company name, or company contact information. The DEA New Orleans office seized the exhibits at a suspected gamma-hydroxybutyric acid (GHB) clandestine laboratory in Metairie, Louisiana. Analysis of the liquid by HPLC and GC/MS indicated gamma- butyrolactone (GBL) (not quantitated, but apparently pure or nearly pure). The laboratory was apparently a prescription drug diversion operation, re-selling various substances over the Internet. There were about a dozen empty bottles of "Once Removed" at the site; the operators were allegedly diluting one bottle into a one liter bottle of Fruit Punch flavored Powerade for resale. While GBL is not an uncommon submission to the laboratory, this is the first exhibit of "Once Removed" nail polish remover.

[Editor's Notes: "Once Removed" is a product of SMS Laboratories in Brooklyn, New York, and is very well known in the GHB abusing community as a source of high purity GBL. The above seizure is unusual because neither the company or product ingredients are listed on the packaging. It is unknown why this information was not included on the packaging in this case.]

Photo 12

The DEA Southeast Laboratory (Miami, Florida) recently received seven commercially labelled cardboard boxes containing 288 cans of Nestle's Supligen® (a dietary supplement drink), suspected to contain solutions of cocaine (see Photo 12). The exhibits were seized from a storage facility in Plantation by agents from the DEA Fort Lauderdale District Office (Plantation is located just west of Fort Lauderdale). Ninety two of the cans contained a thick, clear liquid (total net mass 38.66 kilograms (total net volume 31.69 liters)) that screened positively for cocaine. Analysis by GC, FTIR, and GC/MS confirmed a mixture of cocaine hydrochloride (753 mg/mL) and phenacetin (not quantitated). This was the first submission of liquid cocaine in cans of Supligen to the laboratory.

The DEA Northeast Laboratory (New York, New York) recently received a submission of thirty one lollipops with loose wrappers, suspected to contain heroin (see Photo 13, below). The exhibits were seized at LaGuardia airport by the DEA New York Field Division (circumstances not provided). The wrappers indicated only the flavor of the candy (peach, watermelon, sour, etc.) The pops varied from 3/4's of an inch to one inch in diameter, and (unusually) consisted of a candy shell surrounding a powder interior (see Photo 14, below). Analysis of the powder (total net mass 520.1 grams) by GC/FID, GC/MS and FTIR confirmed 64 percent heroin hydrochloride. This is the first submission of lollipops containing heroin powder to the laboratory; however, the laboratory has previously received lollipops containing cocaine hydrochloride.

Photo 13	Photo 14

SENTRON® FIRE EXTINGUISHERS CONTAINING COCAINE IN NOGALES, ARIZONA

The DEA Southwest Laboratory (Vista, California) recently received a submission of six small Sentron® fire extinguishers, each containing a packed white powder, suspected cocaine (see Photos 15 and 16, below). The exhibits were seized from three different cars in Nogales by Agents from the DEA Tucson Resident Office. The cannisters were labeled in Spanish, and the pressure gauges indicated that the extinguishers were at least partially full; however, none were actually under pressure. The nozzle portions on all six cannisters could be unscrewed; however, removal of the contents required a power saw to cut the cannister open. Analysis of the powder (total net mass approximately 12 kilograms) by GC, IR, and MS confirmed cocaine hydrochloride (average purity approximately 90 percent). This was the laboratory's first encounter with this particular smuggling technique.

Photo 15	Photo 16

[From the NDIC Narcotics Digest Weekly 2004;3(17):3
Unclassified, Reprinted with Permission.]

On April 6, 2004, the governor of Oklahoma signed into law a bill prohibiting over the counter sales of tablets containing pseudoephedrine, a precursor chemical used in the production of methamphetamine. The law designates cold and allergy tablets containing pseudoephedrine as a Schedule V substance that can be sold only by licensed pharmacists or licensed pharmacy technicians. Consumers will be required to present valid photo identification and sign a logbook to purchase the drugs. The law also limits the amount a person can buy or possess to 9 grams (approximately 10 boxes of cold tablets). Any person convicted of violating the provisions of the law faces up to 1 year in jail and/or a $1,000 fine for a first offense (misdemeanor) and a $5,000 fine and a term of imprisonment of not more than 5 years for a second offense (felony). Consumers will still be able to purchase gel cap and liquid forms of the drugs over the counter.

NDIC Comment: Other states, including Missouri and Iowa, have enacted legislation designed to restrict grocery and discount store sales of pseudoephedrine products by requiring that the drugs be placed behind the counter or within sight of clerks. However, Oklahoma is the first state to ban sales of cold and allergy tablets with pseudoephedrine in stores other than pharmacies and to control the sale and the amount of the sale of such products.

[From the NDIC Narcotics Digest Weekly 2004;3(20):1
Unclassified, Reprinted with Permission.]

Law enforcement officials with the Philadelphia Division of the Drug Enforcement Administration (DEA), Philadelphia Police Department, and Carbondale Police Department report increasing diversion and distribution of a prescription pain reliever known as ACTIQ (oral transmucosal fentanyl citrate). ACTIQ contains a form of fentanyl a synthetic opiate that possesses an analgesic potency approximately 80 times stronger than morphine. The U.S. Food and Drug Administration (FDA) approved ACTIQ in November 1998 for the management of cancer pain for patients with malignancies who had already received and had become tolerant to opioid therapy. ACTIQ, one of several fentanyl products available by prescription, is distributed as a medicated raspberry flavored lozenge attached to a short handle resembling a lollipop. As the medicated lozenge dissolves, the active ingredient (fentanyl citrate) is absorbed through the lining of the mouth. ACTIQ is intended only for those already on an opioid based pain management program.

NDIC Comment: The diversion and abuse of ACTIQ likely will increase because of individuals seeking the effects of its active ingredient, fentanyl citrate. The lollipop like administration of the drug is likely to appeal to users who would be hesitant to take a fentanyl tablet, snort fentanyl powder, or inject the drug. Moreover, other fentanyl products, particularly a fentanyl transdermal patch known as Duragesic, already is frequently diverted and abused in many areas. In fact, National Drug Threat Survey 2003 data indicate that 10.2 percent of law enforcement agencies responding nationwide report that fentanyl is commonly diverted and illicitly used in their areas. Law enforcement agencies in the Northeast/Mid Atlantic (12.0%), Pacific (11.6%), and West Central (10.9%) regions report the highest percentages of fentanyl diversion and abuse. DEA officials in Philadelphia report that ACTIQ, referred to as perc-a-pop, is being sold in the city for $20 per dosage unit.

[Editor's Note: For a photo of an ACTIQ lollipop, see: Microgram Bulletin 2004;37(3):49.]

[From the NDIC Narcotics Digest Weekly 2004;3(20):3
Unclassified, Reprinted with Permission.]

On April 27, 2004, officials from the DEA Sioux Falls Resident Office and Sioux Falls Police Department Drug Task Force seized an operational MDMA laboratory from a Marion residence and arrested a 39 year old female and a 25 year old male on charges of attempting to manufacture MDMA and aiding and abetting the manufacture of MDMA. The arrests and seizure were the result of a 3 month investigation conducted to determine the identity of the intended recipients of chemicals being sent to a Sioux Falls post office box. The defendants allegedly purchased chemicals and glassware to manufacture MDMA (3,4-methylenedioxymethamphetamine, also known as ecstasy) through a fictitious company via the Internet and by telephone from companies in California, North Carolina, Ohio, Texas, and the Netherlands. The chemicals, including ether and sassafras oil, and glassware were delivered to the post office box in Sioux Falls. Prior to their arrests, the defendants allegedly produced three batches of MDMA, each weighing approximately 4 grams. According to law enforcement officials, the powdered MDMA was placed in capsules and distributed to individuals at rave parties in Midwest cities such as Chicago and Kansas City for $20 $25 per capsule. Law enforcement officials also seized 4 grams of MDMA, psilocybin mushrooms, marijuana, and $2,500 from the Marion residence. The DEA, Sioux Falls Police Department Drug Task Force, South Dakota Highway Patrol, Turner County Sheriff's Office, U.S. Postal Inspection Service (USPS), Bureau of Alcohol, Tobacco, Firearms, and Explosives (ATF), Mitchell Police Department, and Yankton Police Department participated in the investigation.

NDIC Comment: Law enforcement officials in South Dakota report that this is the first MDMA laboratory seizure in the state. Very few MDMA laboratories are seized each year in the United States. According to DEA El Paso Intelligence Center (EPIC) National Clandestine Laboratory Seizure System data, law enforcement agencies report 3 domestic MDMA laboratory seizures in 2003 compared with 10 seizures in 2002. In 2003 law enforcement officials seized 1 MDMA laboratory each in Florida, Louisiana, and Texas.

The Oregon State Police Crime Lab (Portland, Oregon) recently received two unusual drug submissions from the Portland Police Bureau. The first was a vial of tan powder (total net mass 3.9 grams), commercially (but crudely) labelled as "N,N-Dipropyltryptamine" (photo not available). The label also included the CAS number, warning information, and numbers presumably related to inventory or production batch. The vial was turned over to the Portland Police Bureau by the security personnel for an express mail service. Analysis of the powder by color testing (Webers and PDMAB), GC/MS, FTIR, and UV gave results consistent with dipropyltryptamine (DPT) (not quantitated, but only one peak by GC). However, the results were also consistent with N,N-diisopropyltryptamine (DIPT), and since the laboratory did not have reference standards for either compound, the identification was tentative.

The second submission was a pharmacy-style bottle containing four gel caps, each containing a small amount of fluffy white crystalline substance (total net mass of powder less than 10 milligrams), identity unknown but suspected to be an illicit drug (photo not available). The exhibit was part of a polydrug seizure from an individual in Portland who was arrested for failure to appear for previously filed, unrelated drug charges. Analysis by color testing (Marquis), GC/MS, FTIR, and UV indicated 4-iodo-2,5- dimethoxyphenethylamine (2C-I).

These were the first submissions of DPT (DIPT) or 2C-I to the laboratory.

SELECTED REFERENCES

[Notes: Selected references are a compilation of recent publications of presumed interest to forensic chemists. Unless otherwise stated, all listed citations are published in English. If available, the email address for the primary author is provided as the contact information. Listed mailing address information (which is sometimes cryptic or incomplete) exactly duplicates that provided by the abstracting services. In addition, in order to prevent automated theft of email addresses off the Internet postings of Microgram Bulletin, unless otherwise requested by the corresponding author, all email addresses reported in the Bulletin have had the "@" character replaced by " -at- "; this will need to be converted back (by hand) before the address can be used.]

1. Borngasser J. Lab supplies go to the highest bidder: A brief analysis of clandestine methamphetamine laboratory supplies and methamphetamine precursors being sold on ebay®. Journal of the Clandestine Laboratory Investigating Chemists Association 2004;14(2):8. [Editor's Notes: Presents an overview of the title topic. Note that JCLICA is a law enforcement restricted journal. Contact: Oregon State Police Forensic Laboratory, Central Point, OR (street address and zip code not provided).]
   
   
2. Dimitroff D. Psilocybin mushroom cultivation. Journal of the Clandestine Laboratory Investigating Chemists Association. 2004;14(2):11. [Editor's Notes: Presents an overview of the title topic. Note that JCLICA is a law enforcement restricted journal. Contact: Peel Regional Police, Morality Bureau (Drug Unit), Mississauga/Brampton, Ontario, Canada (street address and Canadian postal zone code not provided).]
   
   
3. Person EC, Knops LA, Northrop DM, Sheridan SP. "One-pot" methamphetamine manufacture. Journal of the Clandestine Laboratory Investigating Chemists Association. 2004;14(2):14. [Editor's Notes: Presents an evaluation of an Internet recipe. Note that JCLICA is a law enforcement restricted journal. Contact: Washington State Patrol, Marysville Crime Laboratory, 2700 116th Street NE, Suite P, Marysville, WA 98271.]
   
   
4. Galand N, Emouf D, Montigny F, Dollet J, Pothier J. Separation and identification of cannabis components by different planar chromatography techniques (TLC, AMD, OPLC). Journal of Chromatographic Science 2004;42(3):130. [Editor's Notes: Abstract not provided. Contact: N Garland, Lab Pharmacognosie, UFR Sci Pharmaceut, 31 Ave Monge, F-3720 Tours, France.]
   
   
5. Pihlainen K, Kostiainen R. Effect of the eluant on enantiomer separation of controlled drugs by liquid chromatography - ultraviolet absorbance detection - electrospray ionisation tandem mass spectrometry using vancomycin and native beta-cyclodextrin chiral stationary phases. Journal of Chromatography A 2004;1033(1):91. [Editor's Notes: Presents the title study on nine amphetamine derivatives (not specified in abstract), methorphan, and propoxyphene. 14 seized drug samples (not specified in abstract) were analyzed using the optimized methodologies. Contact: R Kostiainen, Univ Helsinki, Vikki Drug Discovery Technol Ctr, POB 56, FIN-00014 Helsinki, Finland.]
   
   
6. Van Nimmen NFJ, Veulemans HAF. Development and validation of a highly sensitive gas chromatographic - mass spectrometric screening method for the simultaneous determination of nanogram levels of fentanyl, sufentanil, and alfentanil in air and surface contamination wipes. Journal of Chromatography A 2004;1035(2):249. [Editor's Notes: Focus is on sampling for industrial occupational exposure. Technique uses SIM. Contact: NFJ Van Nimmen, Katholieke Univ Leuven, Lab Occupat Hyg & Toxicol, Dept Occupat Environm & Insurance Med, Kapucijnenvoer 35, 6th Floor, B-3000 Louvain, Belgium.]
   
   
7. Suzuki Y, Arakawa H, Maeda M. The capillary electrophoresis separation of benzodiazepine drugs using dextran sulfate and SDS as running buffer. Biomedical Chromatography 2004;18(3):150. [Editor's Notes: Presents the EKC analysis of 10 benzodiazepines (not specified in abstract). The authors claim that the presented method may also be used for many other pharmaceuticals. Contact: M Maeda, Showa Univ, Sch Pharmaceut Sci, Shinagawa Ku, Tokyo 1428555, Japan.]
   
   
8. Sagmuller B, Schwarze B, Brehm G, Trachta G, Schneider S. Identification of illicit drugs by a combination of liquid chromatography and surface-enhanced Raman scattering spectroscopy. Journal of Molecular Structure 2003;661-662:279. [Editor's Notes: Presents a novel HPLC-SERS technique for analysis of illicit drugs (not specified in abstract). Contact: PALM Microlaser Technologies AG, D-82347 Bernried, Germany.]
   
   
9. Hajdar M, Ruzdic E. Characterisation of heroin samples obtained in the area of the Federation of Bosnia and Herzegovina. Journal of Environmental Protection and Ecology 2003;4(4):873. [Editor's Notes: Presents the title survey, using GC/FID analysis to detect 8 opium alkaloids and 3 typical adulterants. The number of samples and the date range were not specified in the abstract. Contact: Forensic Department, Federal Ministry of Internal Affairs, Sarajevo, Bosnia/Herzegovina.]
   
   
10. Kite GC, Ismail M, Simmonds MSJ, Houghton PJ. Use of doubly protonated molecules in the analysis of cathedulins in crude extracts of khat (Catha edulis) by liquid chromatography/ serial mass spectrometry. Rapid Communications in Mass Spectrometry 2003;17(14):1553. [Editor's Notes: Analysis of fresh khat by LC/MS revealed 62 cathedulins. Contact: Royal Botanic Gardens, Kew, Richmond, UK TW9 3AB.]
    
    
11. Jones, JJ, Kidwell H, Games DE. Application of atmospheric pressure chemical ionisation mass spectrometry in the analysis of barbiturates by high speed analytical countercurrent chromatography. Rapid Communications in Mass Spectrometry 2003;17(14):1565. [Editor's Notes: The title study was performed on 4 barbiturates (barbital, allobarbital, phenobarbital, and butalbital). Contact: Mass Spectrometry Research Unit, University of Wales Swansea, Swansea, UK SA2 8PP.]
    
    
12. Galimov EM, Sevast'yanov VS, Kul'bachevskaya EV, Golyavin AA. Determination of isotopic compositions of carbon and nitrogen by the IRMS method: Implication for the source of narcotic substance origin. Doklady Earth Sciences 2003;393(8):1109. [Editor's Notes: Presents the title study on cocaine and heroin from different regions. Contact: Vernadsky Institute of Geochemistry and Analytical Chemistry, Russian Academy of Sciences, Moscow, Russia 119991.]
    
    
13. Corkery JM, Airs J. Seizures of drugs in the UK 2001. Home Office Findings 2003;202:1. [Editor's Notes: Presents a survey of Class A, B, and C drug seizures made in the U.K. during 2001. Contact: No contact information was provided.]
    
    
14. Watanabe S, Shibata M, Kataoka K. Comparison of data obtained by various GC methods for impurity profiling of stimulant drugs. Kanzei Chuo Bunsekishoho 2002;42:73. [Editor's Notes: Three different GC methods were used for impurity profiling of 10 typical impurities in 12 samples of stimulant drugs (not specified in abstract). This article is written in Japanese. Contact: Central Customs Laboratory, Ministry of Finance, Chiba, Japan 277-0882.]

Additional References of Possible Interest:

1. Meatherall R, Sharma P. Foxy, a designer tryptamine hallucinogen. Journal of Analytical Toxicology 2003;27(5):313. [Editor's Notes: Primary focus is analysis of biological fluids; however, includes a small scale mass spectra (from GC/MS) of "Foxy" (5-methoxy-N,N-diisopropyltryptamine). Contact: R Meatherall, St Boniface Gen Hosp, Lab Med, 409 Tache Ave, Wiinipeg, MB R2H 2A6, Canada.]
   
   
2. Curtis B, Kemp P, Harty L, Choi C, Christensen D. Postmortem identification and quantitation of 2,5-dimethoxy-4-n-propylthiophenethylamine using GC-MSD and GC-NPD. Journal of Analytical Toxicology 2003;27(7):493. [Editor's Notes: Primary focus is analysis of biological fluids and tissue samples; however, includes a small scale mass spectra (from GC/MS) of the title compound (i.e., 2C-T-7). Contact: Office of the Chief Medical Examiner, 901 N. Stonewall, Oklahoma City, OK 73117.]
   
   
3. Zhang S, Zhuang YF, Ju HX. Flow-injection chemiluminescence determination of papaverine using cerium(IV)-sulfite system. Analytical Letters 2004;37(1):143. [Editor's Notes: The title study is presented; the method is adequate for determination of papaverine in pharmaceuticals and in biological fluids. Contact: HX Ju, Nanjing Univ, Dept Chem, Inst Analyt Sci, State Key Lab Coordinat Chem, Nanjing 210093, Peoples R China.]
   
   
4. Vas G, Vekey K. Solid-phase microextraction: A poweful sample preparation tool prior to mass spectrometric analysis. Journal of Mass Spectrometry 2004;39(3):233. [Editor's Notes: Presents an overview and review of SPME. Contact: G Vas, Univ Antwerp, Dept Biomed Mass Spectrometry, Univ Plein 1, B-2610 Wilrijk, Belgium.]
   
   
5. Derringer B, Leigh T. Solving problems in ion mobility measurements of forensic samples with thermal desorption and dynamic modeling. Diss Abstr Int B 2003;64(4):1715. [Editor's Notes: No abstract provided. Contact: Ohio Univ, Athens, OH (no further addressing information provided.]
   
   
6. Schaefer T. Chemists in criminal technology. Nachrichten aus der Chemie 2004;52(2):223. [Editor's Notes: A mini-review covering criminalists and forensic chemists. This article is written in German. Contact: Wiesbaden, Germany (no other addressing information was provided.]
   
   
7. Nguyen DH, Berry S, Geblewicz JP, Couture G, Huynh P. Chemiluminescent detection of explosives, narcotics, and other chemical substances. U.S. Pat. Appl. Publ. US 20040053421 A1 18 Mar 2004. CLASS: ICM: G01N021-76. NCL: 436172000;436164000; 436117000; 436155000; 436159000; 422052000; 422078000; 422080000;422082050; 422082080. APPLICATION: US 2002-241407 12 Sep 2002. [Editor's Notes: Presents the title patent. Narcotics not specified in abstract. Contact: Can. (no further addressing information was provided).]
   
   
8. Brestel M, Gft M, Sharon U. Controlled substance detection and identification system. U.S. Pat. Appl. Publ. US 20040051867 A1 18 Mar 2004. CLASS: ICM: G01J003-44. ICS: G01J003-30. NCL: 356318000; 356301000. APPLICATION: US 2003-428398 2 May 2003. PRIORITY: IL 2002-151745 12 Sep 2002. [Editor's Notes: Presents the title patent. Controlled substances not specified in abstract. Contact: International Technologies (Lasers) Ltd., Israel (no further addressing information was provided).]
   
   
9. Zhang H, Tang J, Liu Y, Shao W, Fan X, Qin Y. Method and test paper for semi-quantitative detection of drugs/medicine by color band-degressive immunological chromatography. Faming Zhuanli Shenqing Gongkai Shuomingshu CN 1,381,729 (Cl. G01N33/558), 27 Nov 2002, Appl. 2,002,114,110, 30 Apr 2002. [Editor's Notes: The title methodology was applied to over 24 drugs. This patent is written in Chinese. Contact: Changsa Mental Disease Hospital, Peop. Rep. China.]

Virtual processing is the simulation of a computer operating system or application program within a real world computer under the control of the host computer's operating system. Virtual processing enables multiple applications to operate in an isolated operating system environment. It also compartmentalizes processes, and can therefore minimize program failures that can stop an entire computer system.

To date, virtual processing has been primarily used in main frame computers, but not with personal computers, due to limitations with PC hardware and operating system architectures. Virtual processing requires extensive computing resources, including fast processor speeds, robust operating system architectures (that support multiple concurrent processing), and fast computer memory management. However, recent advances in these technologies have increased its potential for use in PC's, including for digital evidence examination purposes. In the latter case, potential benefits include reduced examination times and fewer examination computers.

The principal benefit of virtual processing is eliminating the need to run concurrent computer systems in order to view certain types of data. Most digital evidence forensics are conducted using a "forensic platform" such as Access Data's Forensic Tool Kit (FTK), Guidance Software's Encase, or the U.S. Government's Ilook licensed software. These platforms use standard data recovery techniques such as erased file recovery or keyword searching, and are highly effective with routine programs and files. However, there is often a need to run specialized programs in order to view proprietary types of binary data, especially where the data is not stored in a standard ASCII format (that is, that common file browsers can interpret and display). Applications such as financial accounting data and pharmacy transactional data frequently utilize proprietary data storage formats that cannot be viewed using any of the standard digital evidence forensic examination platforms.

In other instances, the ability to view the desktop display of a computer helps the examiner identify the application programs that are important to the computer user. For example, short cuts to ISP's (AOL, MSN, Hotmail, or Yahoo), or frequently used applications such as Quicken, or critical data files such as an Excel spreadsheet. Recovery of these data types requires that a bootable work copy of the hard drive be created in order to run the user's operating system and/or application software.

Virtual processing offers the potential to eliminate the extra steps involved in creating and mounting such bootable work copies. It can take a day or more to create and successfully mount such copies in a different computer hardware environment ? a very significant amount of time for any examiner.

Application of virtual processing to the examination of digital evidence is therefore an important evolutionary advance. To date, there have been five such advances, as follows:

Generation One
Initially, digital evidence was regarded as a static collection of digital data files or fragments of user or computer system generated data. This static data was viewed as objects that could be viewed (browsed) or searched using text string search engines. Use of digital evidence forensic tools permitted analysis without changing any of the data. This has always been a digital evidence forensic best practice.

Generation Two
The second generation of digital evidence forensic techniques improved on the initial, purely static examination approach by utilizing enhanced technical evidence duplication capabilities to create bootable work copies. Reviews are conducted by running a copy of the user's operating system and/or application program. Creating a bootable work copy is a well accepted digital evidence forensic practice that supplements static browsing and keyword searching. However, the technique is limited to viewing application output only, because it changes some file date/time stamps, and also overwrites data in the temporary work files that are managed by the operating system. Therefore, a completely separate examination of a second work copy is often necessary to browse and keyword search other areas of the evidence. This can result in a lengthy examination process.

Generation Three
The third generation of evidence copying technology is known as "imaging". Images are files that can be mounted within a "digital evidence forensic platform". The image files contain an accurate representation of the original evidence, as well as embedded data required for data authentication purposes. In contrast to bootable work copies, image files are not hardware dependent. However, digital evidence examination of images is limited to viewing data in a format that precludes assessment of the user's desktop, or the running of application programs. This can be a significant problem in certain types of cases where the computer user's most commonly accessed programs and/or files are displayed on the desktop, or where specialized programs are needed to access data (for example, financial accounting software frequently needs to be run in order to fully understand data stored in credit and debit columns).

Generation Four
The fourth generation consists of "emulation" technology, which is an application program that gives the appearance that a computer is operating within a computer. One simple example of an emulation program is the use of a Microsoft DOS command line prompt from within a Microsoft Windows operating system (such as Win 95/98). While it appears that any program operating from the DOS prompt is a computer within the Windows 95/98 computer, it is actually a WIN 95/98 operating system program giving that appearance.

A second, well known emulation program is the original Microsoft Windows program named "Windows for Work Groups". As installed on the old Intel 286 computers, this program gave the appearance and feel of Windows, but it was actually a DOS program. It wasn't until Windows 95 was introduced by Microsoft that a true Windows operating system was available to Microsoft software users.

Emulation technology has little substantive benefit in digital evidence examinations. However, it is an important concept in understanding the evolution of computer processing from single dedicated machines to virtual processing.

Generation Five
The fifth and most recent generation of digital evidence forensic technology involves virtual processing wherein a computer actually operates within a computer (that is, not a simulation, but rather in reality). Virtual processing provides the examiner with a choice of utilizing traditional static data recovery techniques while running either the operating system (to view the desktop) or select application programs (to view proprietary binary data and understand the significance of specialized application programs). Virtual processing only involves manipulation of the image file in the computer memory, thereby eliminating the problem of changing file date/time stamp information or temporary work areas associated with the operating system.

Continued technology advances (such as virtual image processing) are an efficient means to examine data both statically and dynamically, without having to produce two evidentiary work copies. Thus, the technique reduces the need for an additional examiner computer or the concurrent additional examiner time needed to make the second copy. This saves both resources and time, two precious commodities in most digital evidence laboratories.

<Published by the Drug Enforcement Administration 
Office of Forensic Sciences Washington, D.C. 20537 

The U. S. Attorney General has determined that the publication of this periodical is necessary in the transaction of the public business required by the Department of Justice. Information, instructions, and disclaimers are published in the January issues.